Cisco Systems DOC-7814982 Default Port Security Configuration, Port Security Configuration Guidelines, Enabling and Configuring Port Security

18-7
Catalyst 2950 Desktop Switch Software Configuration Guide
78-14982-01
Chapter 18 Configuring Port -Based Traffic Control Configuring Port Security
Default Port Security Configuration
Table 18-1 shows the default port security configuration for an interface.
Port Security Configuration Guidelines
Follow these guidelines when configuring port security:
•Port security can only be configured on static access ports.
•A secure port cann ot be a dynam ic acc ess port or a tr unk port.
•A secu re p ort ca nn ot be a de stin ati on port f or Sw itch Por t A na lyze r (SPA N).
•A secu re p ort ca nn ot be lon g t o a Fast Eth erC hanne l o r Gigabi t E the rChann el por t group .
•A secu re po rt cann ot be an 80 2.1 X po rt .
•You cannot configure static secure MAC addresses in the voice VLAN.
•When you e nabl e po rt s ecur ity on a voic e V LAN p ort, yo u must set the ma xim um allowed secur e
addresse s on the po rt t o at le ast two. When t he por t is con necte d to a Cisco IP pho ne , the IP phone
requires two MAC addresses: one for the access VLAN and the other for the voice VLAN.
Connecti ng a PC to th e IP pho ne re qu ires addi tiona l M AC addresses.
Enabling and Configuring Port Security
Beginning in privileged EXEC mode, follow these steps to restrict input to an interface by limiting and
identifying MAC addresses of the stations allowed to access the port:
Table 18-1 Default Port Security Configuration
Feature Default Setting
Port s ecur ity Disabled o n a port
Maximu m numbe r of secure MAC addresses 1
Vi olati on mode Shutdown. The inter face is error-disabl ed when a
security violation occurs. When a secure port is in the
error-disabled state, you can bring it out of this state by
entering the errdisable recovery cause
psecure-violati on glo bal configur ation c om mand, o r
you can m anual ly re-e na ble i t by e nte ring th e
shutdown and no shutdown interface configuration
commands.
Command Purpose
Step 1 configure terminal Enter globa l configurati on mode.
Step 2 interface interface-id Specify t he t y pe a nd num ber of the phy sica l i nte rfac e t o co nfigur e, f or
example gigabitethernet0/1, and e n ter i nte rface configu ratio n m ode.
Step 3 switchport mode access Set the interface mode as access; an interface in the default mode
(dynam ic desi rabl e) c anno t be c on figured as a se cure p ort.
Step 4 switchport port-security Enable port security on the interface.